Connect an AWS Account

Status: CloudBurn Platform has not launched publicly yet. This page describes how it works. Join the waitlist for a 30% founding-member discount: only waitlist members get it, and they keep the lower price for as long as they keep their plan.

CloudBurn Platform scans your AWS account through an IAM role you deploy in your own account, and writes scan results to a results bucket you own. The role reads your resources and writes only to that bucket. CloudBurn never holds long-lived credentials for your account, and the durable copy of your findings lives only in your S3 bucket. CloudBurn reads it to render your dashboard and does not keep its own copy of your scan results. What CloudBurn can and cannot access lists the exact permissions.

Connections belong to your workspace: every member can scan a connected account, and workspace owners and admins can add, verify, rename, and remove connections.

What you deploy

The connection consists of three pieces, all created in your account from a template the dashboard generates for you:

• An IAM role, CloudBurnReadOnlyRole, that CloudBurn assumes to run discovery. It attaches the AWS managed ReadOnlyAccess policy, plus an inline policy that lets it write scan results to the results bucket.
• An S3 results bucket, cloudburn-bucket-<account-id>-<region>, owned by you, where scan output is stored. It blocks all public access, encrypts objects with S3 managed keys (SSE-S3), enforces bucket-owner object ownership, and its bucket policy denies any request that does not use TLS. A lifecycle rule expires every object in it after 90 days.
• An AWS Resource Explorer index and default view in the chosen region — discovery uses Resource Explorer to enumerate resources. You can leave this out if the region already has one.

What CloudBurn can and cannot access

The template the dashboard generates is the full definition, so you can review every statement before you deploy it. In plain terms:

Who can use the role. The trust policy allows only CloudBurn's AWS account (named in the template) to assume the role, and only when it presents the sts:ExternalId that is unique to your workspace. Each session lasts at most one hour: the CloudFormation template sets MaxSessionDuration: 3600, and the Terraform template keeps the IAM default, which is also one hour. CloudBurn gets temporary credentials for each session and stores no access keys for your account.

ReadOnlyAccess is an AWS managed policy that AWS maintains and updates as services launch. It reads data as well as configuration, so the permission itself does not stop the role from reading object contents or table items. If your security review requires a narrower policy, run the open-source CLI with credentials you scope yourself.

What CloudBurn stores on its side. Your workspace, its members and their roles, and, for each connection, the AWS account ID, friendly name, role ARN, deployment method and region, template version, and verification status. For each scan it keeps the status, timestamps, and a pointer to the result files in your bucket. Findings and Cost Tree snapshots themselves stay in your bucket.

Ending access. Removing a connection in the dashboard deletes CloudBurn's record of it but leaves the role and bucket in your account (see Removing a connection). To cut off access, delete the role: delete the CloudFormation stack, run terraform destroy, or delete CloudBurnReadOnlyRole by hand. Without the role, CloudBurn cannot reach the account.

Setup steps

From AWS Accounts in your dashboard, choose Add AWS account (the form opens automatically when you have no accounts yet):

1. Enter the 12-digit AWS Account ID and, optionally, a Friendly name so teammates recognize the account. CloudBurn checks the account as soon as the ID is complete.
2. If the CloudBurn role is already installed in that account — for example, a teammate deployed it earlier — the dashboard reports Existing connection found, and Connect account adopts and verifies it in one step. You can go straight to scanning.
3. Otherwise the dashboard reports Connection setup required. Choose Continue setup to open the setup dialog, then deploy in one of two ways:
   • Copy a template. Pick the CloudFormation or Terraform tab, copy the template (or expand Preview template first), and deploy it through your own IaC pipeline. Both templates create the same resources.
   • Deploy directly. Pick the AWS Region where the integration should live, decide whether to keep Set up AWS Resource Explorer on, and choose Deploy directly through AWS Console. This opens the CloudFormation quick-create flow in a new tab with the template preloaded. Turn the Resource Explorer toggle off if the region already has an index and default view.
4. Once the deployment finishes, return to the dialog and choose Verify connection. CloudBurn checks role access, results storage, and resource discovery before the account can be scanned.

Some optimization checks need additional AWS data sources. Review the guidance shown in Cost Optimization when a check cannot assess your resources.

Reading the account list

Connected AWS accounts shows every connection with its region and a Scan readiness status:

The row menu offers Verify all to re-run every check, and Rename to change the friendly name. If CloudBurn later loses the ability to assume the role (for example, after the stack is modified), the account shows Role access lost and scans pause until you verify the connection again.

Removing a connection

Deleting a connection in the dashboard removes CloudBurn's record of it. It does not delete the IAM role, CloudFormation stack, Terraform resources, or S3 bucket from your AWS account, so the role still exists and CloudBurn's account can still assume it with your ExternalId. Remove those resources through the same mechanism you deployed them with (delete the stack, terraform destroy, or manual cleanup) once you no longer need them. The CloudFormation template retains the results bucket when you delete the stack, so empty and delete the bucket yourself if you no longer want the stored results.

What's next